Cybersecurity researchers discovered that Yoti, a leading age verification provider used by Meta and TikTok, shares users' facial photos and device fingerprints with third-party companies. The London-based firm serves an estimated 60% of websites requiring age checks, but its verification process broadcasts sensitive personal data beyond what's necessary for confirmation.

The study, presented at the IEEE Symposium on Security and Privacy, found that verification attempts transmit facial images, IP addresses, and device identifiers to credit card companies and data brokers. Researchers examined the gap between legal promises of privacy and actual data handling practices.

Digital age verification laws now exist in 25 U.S. states, affecting more than 40% of Americans. However, the research reveals most sites don't enforce these requirements, and users face inconsistent web experiences depending on their location. Some New York sites deploy verification despite no state mandate.

The findings expose fundamental flaws in current age verification systems, creating new privacy risks while failing to reliably restrict minors from adult content. This fragmentation threatens the open nature of the internet, where users in different states may encounter varying access restrictions.